github / github/gh-gei

Migrate Secret Scanning failing to reconcile alerts

Open
#1,599 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
C#
Stars
478
Forks
146
Avg merge
7d 21h
Merged PRs (30d)
2

Description

## Description

I have a customer who is seeing failed secret scanning alerts when migrating from GHES to GHEC-US. The secret scanning alerts have been resolved and closed in source repositories but are not closed post-migration in the destination. This is post-GEI migration. The alert number differs in the source, where secret 1 in the destination is secret 2 in the source. The destination org has a global policy to enable advanced security features.

```
2026-07-09 16:05:05] [INFO] Migrating Secret Scanning Alerts...
[2026-07-09 16:05:05] [INFO] Migrating Secret Scanning Alerts from 'srcOrg/myRepo' to 'destOrg/myRepo'
[2026-07-09 16:05:06] [INFO] Source srcOrg/myRepo secret alerts found: 2
[2026-07-09 16:05:06] [INFO] Target destOrg/myRepo secret alerts found: 1
[2026-07-09 16:05:06] [INFO] Matching secret resolutions from source to target repository
[2026-07-09 16:05:06] [INFO] Processing source secret 2
[2026-07-09 16:05:06] [INFO] secret is resolved, looking for matching secret in target...
[2026-07-09 16:05:06] [WARNING] failed to locate a matching secret to source secret 2 in destOrg/myRepo
[2026-07-09 16:05:06] [INFO] Processing source secret 1
[2026-07-09 16:05:06] [INFO] secret is resolved, looking for matching secret in target...
[2026-07-09 16:05:06] [WARNING] Failed to locate a matching secret to source secret 1 in destOrg/myRepo
[2026-07-09 16:05:06] [INFO] Secret scanning alerts successfully migrated.
```

## Reproduction Steps
We have had this process work for other repositories with the same process:
1. Run GEI repository migration
1. Run GEI secrets migration

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the issue with a GEI repository migration followed by a GEI secrets migration, using the logged source and destination alert counts as a reference. Inspect the secret scanning alert migration and resolution-matching path; done means resolved source alerts are matched and closed in the destination even when alert numbers differ, with logs confirming successful migration.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.